14 DAY TRIAL // The hackers from r00tBeer Security Team have returned with another high-profile data breach. The victim is the website of world renowned electronics manufacturer Philips.
This time, the attackers have leaked much more data. Over 197,000 email addresses, numerous passwords – 400 of which in clear text –, and other details have been published online as a result of the hack.
We have contacted Philips to find out why some of the passwords have been stored in clear text and to learn if anything is being done to prevent such incidents from occurring in the future.
In the meantime, experts once again highlight the need for proper security practices when it comes to the storing of passwords in website databases.
“Don't store plaintext passwords, and don't lose your password database either. By leaking passwords, you may give away personal information beyond the scope of the user and the data you're protecting,” Paul Ducklin, head of technology at Sophos Asia Pacific, explained.
“Philips also appeared to have blundered in one of the other password databases stolen, using what looked at first glance just like raw MD5 hashes of the user's passwords. There was no random per-hash content (better known as salt),” he added.
“Without password salts, if two users choose the same password, you can tell at a glance because they get the same hashed password. Crack one, crack all.”
On the other hand, Philips isn’t the only website hacked yesterday by r00tBeer. They also claim to have gained access to the databases of The Student Room (thestudentroom.co.uk).
The file they have published online – allegedly containing user details – has been removed by MediaFire, but we have reached out to The Student Room representatives hoping they can confirm or deny the hacker’s claims.
r00tBeer Security Team became known a couple of days ago when they took credit for breaching the official AMD blog, leaking around 200 records containing user information. AMD representatives have confirmed the hack after taking the blog offline.
Update. You can find Philips' complete statement and additional explanations here.